3e43c01eec0eb69c87091791a638320256d4d34cc2fa60c76ce7dd9493cce73b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260426-melv4ady5w
SHA256 3e43c01eec0eb69c87091791a638320256d4d34cc2fa60c76ce7dd9493cce73b
MD5 45420c05ea7571fed382ac10a407ded5
SHA1 c6f066c95bfa6f1b5a80bf1542aae6bfe4c9abe1
SHA512 15f2ef996c1850fc63c386ca4520700b2703a80068edc3f9af65a58945f21e7cdedebd9f974381ac1599f23ffd2b8b756111b0fc8cd405658f62c5fce00aa932
SSDEEP 24576:EDdYu7wYAQepUML1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krs:h/VJkGYYpT0+TFiH7efPIy+
TLSH
T1AAC5BD01F3C666F6C4AF0578947A531AA671FC0503A1DBFB6694AA792D333C08E317A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
44	4332	dfsvc.exe
44	4332	dfsvc.exe
44	4332	dfsvc.exe
44	4332	dfsvc.exe
44	4332	dfsvc.exe
44	4332	dfsvc.exe
44	4332	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "WV6ENB5GBY4OWWDT1N6HEX6B"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\Files\ScreenConnect.WindowsClient.exe_6492277df2d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\DigestValue = 33e47573b3b9e384128ca4f66d6ae73f83f3dd89	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b898 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\lock!0c000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\implication!scre..tion_27fa83f1ad328157_001a.0001_f235 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_f235bf3d1f494509	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\implication!scre..tion_27fa83f1ad328157_001a.0001_f235 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\implication!scre..tion_27fa83f1ad328157_001a.0001_f235 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\DigestValue = 5d4cdf6d1b1c625770877bc03c75c36a7c65afe3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea16 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\lock!1c000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\lock!06000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\lock!18000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "8PJ1ZMHAPRNYENQ0YOBA12M6"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\SizeOfStronglyNamedComponent = 0ae9040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\Files\ScreenConnect.ClientService.dll_e781b1c636f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\lock!0a000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\implication!scre..tion_27fa83f1ad328157_001a.0001_f235 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\SizeOfStronglyNamedComponent = 217e060000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\lock!01000000f282590eec100000900b000000000000000000009 = 30303030313065632c30316463643536366138333236366635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\lock!06000000b784590eec100000900b000000000000000000002 = 30303030313065632c30316463643536366138333236366635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0\implication!scre..tion_27fa83f1ad328157_001a.0001_f235 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\lock!0e000000b784590eec100000900b000000000000000000002 = 30303030313065632c30316463643536366138333236366635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\lock!08000000b784590eec100000900b000000000000000000002 = 30303030313065632c30316463643536366138333236366635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\lock!04000000c487590e3c0900000403000000000000000000008 = 30303030303933632c30316463643536366363616466356533	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4332	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4332	2480	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	90
PID 4332 wrote to memory of 2364	4332	dfsvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049.cdf-ms
Size 32KB
SHA256 40776c411d463295a68a7ff569f8e954699cd9ccd8754d1e0769c845fa57b9f7
MD5 e2be4e0a7eafcdfc756fcd034bf215f7
SHA1 2be691f40fc081012feb3b475daf633c54bca6c3
SHA512 958e783a1d676bc96d93f33ce542de238fa1bf6d5daf41c40056429947c8df6a31c883e0a866401aa439f76106a8e0ff5bda04f1d60a441f9e101a16ceb34a36
SSDEEP 768:IH4aZ9UTPL10efgP2am6Yc2bS4VRU2Xtj98gr:keXicPLfvW2j/
TLSH
T1CCE25B19BE41E677C2224A3AADFBC76C66143E534EA901CB3444333FA4305895F3579D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d.cdf-ms
Size 3KB
SHA256 87a06f07da921a18d28dba8d323ba3bd61a2083848ea42eb8a25464fe07cd58b
MD5 d305e9313ae34ac5e3dfa9b0561d2a0c
SHA1 90e50ebf4ba14625040d98e73dbfdcc9c10265ab
SHA512 f24de96d614fee7e0c71d1db9b8d3cd67b707920e5dd1dd65604ec28e9d7284da1c3af1345fcce7faed88a5525a7a6e9b693082545ed18a25dafe1f552028c60
TLSH
T189612E027340DA17EA7A07326CF2C2DA2FA87D93DE81510FF4C03B6F35365A546123A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad.cdf-ms
Size 5KB
SHA256 81ccf9228de48c809d92ced463f3df14b302388af6746da3eaa97a4dbcb7a56a
MD5 25ac82d09a3ba26113a9c2343a549e75
SHA1 b2ce3c5d9b299e3b2c1aa04342c23806b27deb7e
SHA512 8389c65d9f5bf6d9542fb7dca44ef3e27770d579021aee2b1c446dee28a8af1910745558de2f1239a1d3e3c68dd7df604e0dedae7e0b7c2a64cf6707d2e4c62c
SSDEEP 96:i3A+RxU9L8eV+Ww7bIib2nkLyrRq5Xm7gr51IC1gnPseO:+RxUNzJJiasuq5kisbO
TLSH
T1ADB11002B394D917E5B90633ACAAC3DD2B38BD83DE03431B71D47B2F7932A965612285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a.cdf-ms
Size 6KB
SHA256 5c5e70f5da2305c7374dc49e555bb6a5205b03a0d0fe528c47ed7e006a845cca
MD5 1debd6734a2a7a1326325a45e55aea60
SHA1 52e2a697eeee0523a0e4e6cc76297d5f06ee5a22
SHA512 ed35be7b006bbde29d994ecd995328b57edd13e6b3987187f91d1e932db2e71aef34f937095061a1355f7fbb6dbd8c8926a1df5970c4585fa3dd8b51532811ce
SSDEEP 96:QAl1vFaunTq5CeV+Www786hTYSt9w2CZOnNsFVukoRc6qITl1t:7LaunTqvJjhT5iHNoRBT
TLSH
T111E15A11B280EE57D1A90A339C96C3DC67697E86CE43170BB1C4BB3F7A726E62312195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381.cdf-ms
Size 2KB
SHA256 2e286e454d1cf88ba0431bcd9134482cee246fc873eb60272518a8a4925f3564
MD5 34f306de3999c3db14df702b6ce8b251
SHA1 8a0388d5fd615ce03bccd6ebcf66438063f8e665
SHA512 12956e0c4b825b17aa24b467db24234399909e43563d9cfeb37aa3305edf9c402926038cb9238d7437d32ba64de18bb36843215761d6dd4af75b0e0cac1b3fa7
TLSH
T14D51AB057684EE67E66A0633ECD2D2D933367E82EF47130BB180BB7F3A716C15612096
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0.cdf-ms
Size 22KB
SHA256 bfa05ef423b3af452e940d1d7a408530a78676f2030345ba6475c09027a92588
MD5 5c18909f12195857763edcb3e48d52d1
SHA1 ba1a5f4231e5c27721c23a2131e527540765e74b
SHA512 a07689e5e1e8bb1318de044a4fbd7f3c7e79d2149dff1244d8a6c5b8d829cf17c6a8a0967fb5a26dc945770d5a85f6bc4f78698b0afccebfd1502248f1d7172b
SSDEEP 384:wwS9BE7a77EezPBbEeznljP2psgM7Ypfi17P2aa16YcnVC1bS4VkTkM5jUcrGv0:q8aLPL10pfgP2am6Yc2bS4VRz8
TLSH
T1CEA25B657A41EB53C2635A329C83CBE4B1687E824EC2429FBC95373F5478F0A3762985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8.cdf-ms
Size 4KB
SHA256 fe156df98dee0323f72bd67952cd8b7653e954c80347c999e7f2bd4393cf1bef
MD5 2316fa92e33d9c872c2318a8a552e88c
SHA1 c72bc0347a42ad15f7b7679eab266fb512af3a61
SHA512 4db3a4b31154ef39f32de9b6ef2ede699ff1f85656657b2a3956d2f5aaef39448cbfafd6110bc72193c844fff0a960dca59b3cb9bf1e94449ea844a997da349c
SSDEEP 96:hQgSOyeV+Ww874wWJtxmJp7yBfSBv0kDPudiV:zJ1WR27rv0M/V
TLSH
T162A18B117280EE27E5A90633AC92C3DD3A767D82DE43130BB1C4BF2F76326D65326196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\ScreenConnect.ClientService.exe
Size 93KB
SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
MD5 751e8bcc20a49aeab090d99a6417919f
SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
TLSH
T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\380OOHVK.QZP\0Y5QXRHJ.GCC\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Client.dll
Size 411KB
SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
MD5 62d114c95b604d7ca684759c22c4c688
SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
TLSH
T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 5963579d8629fc62000fa7af323834f3bdbed73cb85f5754552506dca02a7d0d
MD5 ec9a8a2b454025bc00746cd3b391c02b
SHA1 44c4d1edd49b345e8bb730563e64d7423f935671
SHA512 bf27d0b64ef31aa55d8145d4e38f9766cc3041ae367f1a633c6d32869d3e16cd7404d614e87cd33fa92378b64a0f4971e04d74cea2875428de4fcaebfdca7339
TLSH
T1B111591191C4FA361F3342D1FEE7E460676E5B23048E294BB069685F8B29AD643470B7
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.ClientService.dll
Size 90KB
SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
MD5 cee388546abc6dfb7a766a33a8066ff5
SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
TLSH
T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 c6428da241e4edf931ca9f99d47058e1f6e2783401b491edf28628264c74b7bf
MD5 9902527b73ea808bbb75f60cfd9f0a49
SHA1 811b2eca8a75f846a5151d6beb779a058eef7c09
SHA512 76271945e2008283cdb0a7da97680e232e825d166dcc404a8aa82be7d15d81cfbbde2c36b6df8187a93ce5f92b358e2a1a4cb704980e22c97f8d326d69ff9039
TLSH
T1D331F61191C4FA351F3302C1BEE7E4605B9E5722158E290BB059A95FCF2DA97434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Core.dll
Size 572KB
SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
MD5 f5be8d175195df18890643f146ec4383
SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
TLSH
T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 e26a8d6784945e3fb747684e5addfbe2b4d6dd13e09cb38bc368649ee986acf8
MD5 d0554a69af0cff7e4e7e29598577b6a1
SHA1 17094b1065eed42ff07aa6b725328876a1b48f70
SHA512 5d783818d36b4a5799a7a86696c994b8799c21675799780137b0ba62dd72562e202c3a001afebb166c191b7d4f5fa61fd9b8d197d70970683f659e86e8bfdc19
TLSH
T150216A1181C8FA261F3302D2BEE7E42197AE5733148D194B7069685FCB1DAD24747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
MD5 63d6f975924dee293c5346992cf1b10d
SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
TLSH
T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 fce0528fad5368a0f69e53adf873f618770eac851d3eaa75af35ec1766066b23
MD5 4e285c2cb42b1c8b6083b91dd7e678c8
SHA1 e539f6ab0aae219036cc24b6e116af28bcd1afc1
SHA512 eb86a2480c8388267d4c6caed86805b29771ba5f1b5cabcfd6b975cdfc518cef62176ac971219743403dee432af3e06567599087c312c4232aae6e1fe973b543
TLSH
T1F541F11281C8FA250F3302C2BEEBE431979E5723158E190B7099AD8BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 0e6502db9fcae756f42f1e32cbb70b87b54286cc9ea1b7a83f51f57b10975aad
MD5 222611c5a579a6e22a3333dcd3587aba
SHA1 a1cc8b62acbb217146525a20f26e9ef4241e8563
SHA512 c498d3d23f9d0278b6b9b98e497fbe7d70ef02173b079ba03ec8ed3aa235102eefb59ee482288132ee2d9844935d1ac5ccbc0ba93a48825d89d2b515fa02551c
SSDEEP 768:UzlYsf/wCdOBti+3kDeuRsUQHkyik5lvmDSmBsuMQX5E+TCMXESslUqt6LYiDLkN:URYKtdU39PVlvmDqfQX5E+TC7Sa6L7wF
TLSH
T135637E5023DC9535E9FF2E34B4E1F6600AB3BA638CE1D7D52DA821DA2E127C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe
Size 665KB
SHA256 6e95d68102dc761942e67e2337ad8e49d32ee7c8943340489a01e2c56ea6e00b
MD5 1bec5ec41f5a88bab602ba15d6d2879d
SHA1 859fd0edba414551a48d598141a58fabbb343715
SHA512 8c9fda75e2309942041f1c76bdb5989a26767d64086d1502e6184fd9b404f22af652d967a661a4262fe073130947e839005dbc4d540707d6739d3d9b045cd5b1
SSDEEP 6144:CJdXZuij7nl/k+XKzIHWxInzii8IiHx4PAyYES4QtkU/ycMF2/B4IF1ICkJAs1iV:Cw67l/5KM2yuKYmS4QjjIm1ZT/
TLSH
T184E47E1137ACDB7BC4EF0B76A432195517B8E802A585E7CFF640A0E95D863809E067EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 81c50d427bb9ed2323d996df65548227f4772f6f595f8fa671fccca3e1338b60
MD5 0ce3d8db5ded9604b0c64de520de16fb
SHA1 2403fc18b63d115e6aa29f7be014464dc8ff7a69
SHA512 557becbab43cffa73dc5554af81b30eb70ad15f357f1f981fe7edb19326fa6254b0607b707b7166a6230b96d0e581e93de6a027a4dfc4c705fc90df25960a10b
TLSH
T1E051C51151C4FB250F3302C1BEEBE470979E5722158E290B7099998FCF2DA974787077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 7581da51f7320569eabee73726ae3be83514b5a7e2989b86914d6d39ff2f30a4
MD5 d50abe1cfcb66eea8191c3895b597507
SHA1 5d4cdf6d1b1c625770877bc03c75c36a7c65afe3
SHA512 1c828385aeea4a75910d81fb5c8b163711ea12b8180b2951af38f46e609fa278fcc8018c50e00cc86f28e48a92d444bde46a3dd4e541c839a2a0252978d2b768
SSDEEP 384:te697gm3U/UGaenfaVXEezImpCMEezuEeznljP2psHM7Y7fi17P2aa16YcnVC1bZ:tbaa4mUtPLs07fgP2am6Yc2bS4VRUi
TLSH
T1BAC23A9A8CC13D21033391D0FFE38A28BD047B6305ED109A7D4D159F9F59A5A67A32EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9RBQWWYX.LZO\2DZGV4L4.24H\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a40087c78a18f9d177dfe5fa5f0bec2cf113a80c2ffbe4d0ec3d582b067120d5
MD5 ebebb49c1d1e6f35febe4b8d4138f7b5
SHA1 00337a0af8352464407d9b8f114ad798ba99bee5
SHA512 ec5dca6e88e671be2c72afde9e235c0ce47e782bb96931c8d52dc0fe9e138dc14f84caef8bd29275daa75fb414c20000c84e94bc011e3095af4125d67ee4d831
SSDEEP 1536:FHMxIdlP49mjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdibp7M:IIPHukLCwpA
TLSH
T1DD93D59235266235DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5WL8KWTN.6AD.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EZ192DQ2.DJH\5WL8KWTN.6AD.application
Size 114KB
SHA256 dfbd14b5f2f5343fc34c6f1d31b9dc5cd5820c92d4851bf217cd6c8562ab4563
MD5 540646ee89af0968fd026ebe9dd37f3d
SHA1 4638ac4a1cc95951df4d56942012a2bcb8c1b99d
SHA512 17c3f6eb01ba5a214de1fe5b13bbe4ece60e750023d1c32413fb1e2c9eebe51b0445b4e233858f814f47506941ff1871039e45ae77f11a753c6e2f180815160f
SSDEEP 1536:PvOPLfvy/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu5KQ/IuKE:P2PLfvy/YHhlWCRbW22XOcu5X1
TLSH
T106B3A53ACE30F4C0477DB021D1A52D673D811B93DBB31BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2364-383-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

Download

memory/2364-370-0x0000000000560000-0x000000000060A000-memory.dmp

Download

memory/2364-384-0x000000001C500000-0x000000001C615000-memory.dmp

Download

memory/2364-380-0x0000000002850000-0x000000000286A000-memory.dmp

Download

memory/2480-6-0x00000000054D0000-0x0000000005A74000-memory.dmp

Download

memory/2480-0-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/2480-1-0x0000000000D40000-0x0000000000D48000-memory.dmp

Download

memory/2480-4-0x0000000004E60000-0x0000000004EF4000-memory.dmp

Download

memory/2480-17-0x0000000007FD0000-0x0000000008583000-memory.dmp

Download

memory/2480-2-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/2480-3-0x0000000001170000-0x000000000117A000-memory.dmp

Download

memory/2480-5-0x0000000004EF0000-0x0000000004F18000-memory.dmp

Download

memory/2480-12-0x0000000007FD0000-0x0000000008583000-memory.dmp

Download

memory/2480-11-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/2480-10-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/2480-9-0x0000000007CD0000-0x0000000007E80000-memory.dmp

Download

memory/2480-8-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/2480-7-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/4332-13-0x00000263A5310000-0x00000263A5318000-memory.dmp

Download

memory/4332-90-0x00000263C3520000-0x00000263C353A000-memory.dmp

Download

memory/4332-84-0x00000263C39C0000-0x00000263C3B70000-memory.dmp

Download

memory/4332-78-0x00000263C3700000-0x00000263C3794000-memory.dmp

Download

memory/4332-72-0x00000263C37C0000-0x00000263C386A000-memory.dmp

Download

memory/4332-66-0x00000263C36D0000-0x00000263C373A000-memory.dmp

Download

memory/4332-41-0x00000263BFE20000-0x00000263BFF35000-memory.dmp

Download

memory/4332-42-0x00000263BF950000-0x00000263BF960000-memory.dmp

Download

memory/4332-40-0x00000263A56A0000-0x00000263A56AC000-memory.dmp

Download

memory/4332-20-0x00000263BFC90000-0x00000263BFCE0000-memory.dmp

Download

memory/4332-382-0x00000263BFE20000-0x00000263BFF35000-memory.dmp

Download

memory/4332-15-0x00000263BF950000-0x00000263BF960000-memory.dmp

Download

memory/4332-14-0x00000263BF9D0000-0x00000263BFB56000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads